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The final page of this brief bears the practitioner's signature. 

I REAL PARTY IN INTEREST (37 C.F.R. § L192(c)(l)) 

The real party in interest in this appeal is XACCT Technologies, LTD. 

II RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 1.192(c)(2)) 

With respect to other appeals or interferences that will directly affect, or be directly affected by, 
or have a bearing on the Board's decision in the pending appeal, there are no other such appeals 
or interferences. 

III STATUS OF CLAIMS (37 C.F.R, § L192(c)(3)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: 1, 3-10, and 12-17. 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration but not canceled: None 

2. Claims pending: 1,3-10, and 12-17 

3. Claims allowed: None 

4. Claims rejected: 1, 3-10, and 12-17 

C CLAIMS ON APPEAL 

The claims on appeal are: 1, 3-10, and 12-17 

IV STATUS OF AMENDMENTS (37 C.F.R. § 1.192(c)(4)) 
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As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 

V SUMMARY OF INVENTION (37 C.F.R. § L192(c)(5)) 

A method and apparatus for reconstructing a session using a first analyzer coupled to a second 
analyzer are provided. As set forth in Figure 7 and the associated description, session 
reconstruction is performed on packets received at the first analyzer. Moreover, responsive to 
unsuccessful session reconstruction on the first analyzer, one or more messages are sent to the 
second analyzer. See lines 19-21 of page 20 of the originally filed specification. The one or 
more messages from the first analyzer to the second analyzer comprise packets received by the 
first analyzer which are unrecognized, and the second analyzer recognizes the unrecognized 
packets to successfully reconstruct the session. See Figure 7 and the associated description. 

VI ISSUES (37 C.F.R. § 1.192(c)(6)) 

Issue #1: The Examiner has rejected Claims 1, 10 and 14 under 35 U.S.C. 103(a) as being 
unpatentable over Gleichauf et al. (6,499,107), in view of Chiu (5,101,402). 

Issue #2: The Examiner has rejected Claims 1, 3-10, and 12-17 under 35 U.S.C. 103(a) as being 
unpatentable over McCreery et al. (5,787,253), in view of Chiu (5,101,402). 

Issue #3: The Examiner has rejected Claims 1, 3-10, and 12-17 under 35 U.S.C. 103(a) as being 
unpatentable over Abromavage et al. (WO 00/6881 1), in view of Chiu (5,101,402). 

Issue #4: The Examiner has rejected Claims 5 and 17 under 35 U.S.C. 103(a) as being 
unpatentable over Abromavage et al. (WO 00/6881 1), in view of McCreery et al. (5,787,253). 

VII GROUPING OF CLAIMS (37 C.F.R. § 1.192(c)(7)) 
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The claims of the following groups do not stand or fall together. Following is the grouping of 
claims. In the following section, appellant explains why the claims of each group are believed to 
be separately patentable. 

Issue # 1: Grouping of Claims 1,10, and 14 
Group #1: Claims 1, 10 and 14 

Issue # 2: Grouping of Claims 1,3-10, and 12-17 

Group #1: Claims 1, 5-6 and 8-10, 12-14, 15 and 17 
Group #2: Claim 3 
Group #3: Claims 4 and 16 
Group #4: Claim 7 

Issue # 3: Grouping of Claims 1,3-10, and 12-17 

Group #1: Claims 1, 5-6 and 8-10, 12-14, 15 and 17 
Group #2: Claim 3 
Group #3: Claims 4 and 16 
Group #4: Claim 7 

Issue # 4: Grouping of Claims 5 and 17 
Group #1: Claims 5 and 17 

VIII ARGUMENTS (37 C.F.R. § 1.192(c)(8)) 

Issue #1: 

The Examiner has rejected Claims 1,10 and 14 under 35 U.S.C. 103(a) as being unpatentable 
over Gleichauf et al. (6,499,107), in view of Chiu (5,101,402). 

Group #1: Claims 1,10 and 14 
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With respect to Group #1, the Examiner has admitted that the primary reference does not 
specifically teach the operation of sending one or more messages to the second analyzer 
responsive to unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session. The Examiner 
further argues that it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to modify such primary reference in view of Chiu to provide the claimed 
features lacking in the primary reference. 



Appellant respectfully disagrees with this assertion, as it appears that the Examiner has not 
considered the full weight of appellant's claims. Specifically, appellant claims, in each of the 
present claims: 



"wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer which are unrecognized, and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session" (or similar 
language). 



To this end, the Examiner's proposed combination still fails to meet appellant's claimed 
invention. Specifically, the Examiner relies on Fig. 9 and the following excerpt from Chiu to 
make a prior art showing of the foregoing claim limitations. 



"Other types of packets can exist on a DECnet network. The various 
types of DNA packets include 'terminate session' packets; 'link 
service' packets; and 'ACK' packets acknowledging receipt of a packet. 

In addition, yet other types of packets exist on a DECnet. These other 
types of packets are well-known in the networking art and will not be 
described herein. 

FIG. 8c shows a session key which has been extracted from either the 
packet header of FIG. 8a or the packet header of FIG. 8b. A unique 
session key is extracted for each session and serves to identify the 
packets of the session. Each session key preferably is 32 bits long and 
comprises 16 bits from the Initiator DECnet Node Address field and 16 
bits from the Initiator Logical Link Address field of the initiator 
address 138/158 in the packet header. 

FIG. 9 is a flow chart of the steps of the method of the present 
invention performed by the session information collecting part 92 to 
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process a packet header from a Transport Layer level packet. If the 
packet header is from a Session Control packet, such as the ^connect 
initiate' packet of FIG. 8a, (Step 160), control passes to Step C of 
FIG. 10. If the packet header is from a data packet, such as the packet 
header of FIG. 8b, (Step 162), control passes to Step D of FIG. 11. If 
the packet header is from a Link service packet (Step 164), control 
passes to Step E of FIG. 12. If the packet header is from an ACK packet 
(Step 166), control passes to Step F of FIG. 13. If the packet header 
is from some other type of packet, then the unknown packet type is 
processed (Step 168)." (col. 8, line 61 - col. 9, 25) 

Such excerpt, however, merely suggests a technique for managing packets based on a header 
thereof. This clearly falls short of the specific functional interaction between a first and second 
analyzer , as claimed by appellant. 

Specifically, there is no '' sending one or more messages to the second analyzer " in response to 
the specific condition of an " unsuccessful session reconstruction ," as claimed, "wherein the one 
or more messages from the first analyzer to the second analyzer comprise packets received by 
the first analyzer which are unrecognized, and the second analyzer recognizes the unrecognized 
packets to successfully reconstruct the session " (or similar language). 

Appellant argues that the clear deficiencies in the Examiner's proposed combination would not 
have been obvious, since such aspects of the claimed invention provide such paramount benefits. 
By appellant's unique claimed features, the present invention is capable of better dealing with 
unrecognized packets by sending them to another analyzer for recognizing the unrecognized 
packets to successfully reconstruct the session. Appellant contends that simply nowhere in the 
prior art is there such a multi-analyzer technique, as specifically claimed, for improved session 
reconstruction. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 



Appellant's Brief-page 6 of 20 



success must both be found in the prior art and not based on appellant's disclosure. In re 
Vaeck947 F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 



Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Issue #2: 

The Examiner has rejected Claims 1, 3-10, and 12-17 under 35 U.S.C. 103(a) as being 
unpatentable over McCreery et al. (5,787,253), in of Chiu (5,101,402). 

Group #1: Claims I 6, 8-10, 12-14, and 15 

With respect to Group #1, the Examiner has admitted that the primary reference does not 
specifically teach the operation of sending one or more messages to the second analyzer 
responsive to unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session. The Examiner 
further argues that it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to modify such primary reference in view of Chiu to provide the claimed 
features lacking in the primary reference. 

Appellant respectfully disagrees with this assertion, as it appears that the Examiner has not 
considered the full weight of appellant's claims. Specifically, appellant claims, in each of the 
present claims: 

"wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer which are unrecognized, and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session" (or similar 
language). 
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To this end, the Examiner's proposed combination still fails to meet appellant's claimed 
invention. Specifically, the Examiner relies on Fig. 9 and the following excerpt from Chiu to 
make a prior art showing of the foregoing claim limitations. 



"Other types of packets can exist on a DECnet network. The various 
types of DNA packets include 'terminate session' packets; 'link 
service' packets; and 'ACK' packets acknowledging receipt of a packet. 

In addition, yet other types of packets exist on a DECnet. These other 
types of packets are well-known in the networking art and will not be 
described herein. 

FIG. 8c shows a session key which has been extracted from either the 
packet header of FIG, 8a or the packet header of FIG. 8b. A unique 
session key is extracted for each session and serves to identify the 
packets of the session. Each session key preferably is 32 bits long and 
comprises 16 bits from the Initiator DECnet Node Address field and 16 
bits from the Initiator Logical Link Address field of the initiator 
address 138/158 in the packet header. 

FIG. 9 is a flow chart of the steps of the method of the present 
invention performed by the session information collecting part 92 to 
process a packet header from a Transport Layer level packet. If the 
packet header is from a Session Control packet, such as the 'connect 
initiate' packet of FIG. 8a, (Step 160), control passes to Step C of 
FIG. 10. If the packet header is from a data packet, such as the packet 
header of FIG. 8b, (Step 162), control passes to Step D of FIG. 11. If 
the packet header is from a Link service packet (Step 164), control 
passes to Step E of FIG. 12. If the packet header is from an ACK packet 
(Step 166), control passes to Step F of FIG. 13. If the packet header 
is from some other type of packet, then the unknown packet type is 
processed (Step 168)." (col. 8, line 61 - col. 9, 25) 

Such excerpt, however, merely suggests a technique for managing packets based on a header 
thereof. This clearly falls short of the specific functional interaction betw^een a first and second 
analyzer , as claimed by appellant. 



Specifically, there is no " sending one or more messages to the second analyzer " in response to 

the specific condition of an " unsuccessful session reconstruction ," as claimed, "wherein the one ( 

or more messages from the first analyzer to the second analyzer comprise packets received by 

the first analyzer which are unrecognized, and the second analyzer recognizes the unrecognized 

packets to successfully reconstruct the session " (or similar language). 
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Appellant argues that the clear deficiencies in the Examiner's proposed combination would not 
have been obvious, since such aspects of the claimed invention provide such paramount benefits. 
By appellant's unique claimed features, the present invention is capable of better dealing with 
unrecognized packets by sending them to another analyzer for recognizing the unrecognized 
packets to successfully reconstruct the session. Appellant contends that simply nowhere in the 
prior art is there such a multi-analyzer technique, as specifically claimed, for improved session 
reconstruction. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. In re 
Vaeck9Al F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Group #2: Claim 3 

With respect to Group #2, the Examiner relies on the following excerpt from McCreedy to make 
a prior art showing of appellant's claimed "wherein the one or more messages from the first 
analyzer to the second analyzer further comprise hints generated by the first analyzer" (see Claim 
3). 

"This information includes administrative data such as timing and 
sequencing data regarding the exchange of packets between nodes." {see 
col. 2, lines 22-24) 
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Such excerpt and the remaining McCreedy reference, however, fails to disclose, teach or even 
suggest any communication of "hints" between the alleged first analyzer [336, Fig. 4c] and the 
alleged second analyzer [346, Fig. 4c]. 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Group #3: Claims 4 and 16 

With respect to Group #3, the Examiner relies on the following excerpt from McCreedy to make 
a prior art showing of appellant's claimed "wherein hints for a packet comprise a time the packet 
was received and an address information for the packet" (see Claim 4). 

''This information includes administrative data such as timing and 
sequencing data regarding the exchange of packets between nodes." (see 
col. 2, lines 22-24) 

Such excerpt and the remaining McCreedy reference, however, fails to disclose, teach or even 
suggest any hint including "a time the packet was received and an address information for the 
packet " (emphasis added). 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Group #4: Claim 7 

With respect to Group #4, the Examiner relies on the following excerpt from McCreedy to make 
a prior art showing of appellant's claimed "wherein the one or more messages from the first 
analyzer to the second analyzer comprise summary of packets received by the first analyzer and 
one or more hints generated by the first analyzer" (see Claim 7). 
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"An application level protocol translator translates the raw 
transaction data and stores the data in a translated transaction data 
buffer. The translated data provides high level information regarding 
the transactions between nodes which is used to monitor or compile 
statistics regarding network or internetwork activity." (see col. 2, 
lines 34-39) 

Such excerpt and the remaining McCreedy reference, however, fails to disclose, teach or even 
suggest any communication between the alleged first analyzer [336, Fig. 4c] and the alleged 
second analyzer [346, Fig. 4c], where such communication includes a "summary of packets 
received by the first analyzer and one or more hints generated by the first analyzer." 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Issue #3: 

The Examiner has rejected Claims 1, 3-10, and 12-17 under 35 U.S.C. 103(a) as being 
unpatentable over Abromavage et al. (WO 00/6881 1), in view of Chiu (5,101,402). 

Group #1: Claims I 6, 8-10, 12-14, and 15 

With respect to Group #1, the Examiner has admitted that the primary reference does not 
specifically teach the operation of sending one or more messages to the second analyzer 
responsive to unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session. The Examiner 
further argues that it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to modify such primary reference in view of Chiu to provide the claimed 
features lacking in the primary reference. 
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Appellant respectfully disagrees with this assertion, as it appears that the Examiner has not 
considered the full weight of appellant's claims. Specifically, appellant claims, in each of the 
present claims: 



"wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer which are unrecognized, and the second analyzer 
recognizes the unrecognized packets to successfially reconstruct the session" (or similar 
language). 



To this end, the Examiner's proposed combination still fails to meet appellant's claimed 
invention. Specifically, the Examiner relies on Fig. 9 and the following excerpt from Chiu to 
make a prior art showing of the foregoing claim limitations. 



"Other types of packets can exist on a DECnet network. The various 
types of DNA packets include 'terminate session' packets; 'link 
service' packets; and 'ACK' packets acknowledging receipt of a packet. 

In addition, yet other types of packets exist on a DECnet. These other 
types of packets are well-known in the networking art and will not be 
described herein. 

FIG. 8c shows a session key which has been extracted from either the 
packet header of FIG. 8a or the packet header of FIG. 8b. A unique 
session key is extracted for each session and serves to identify the 
packets of the session. Each session key preferably is 32 bits long and 
comprises 16 bits from the Initiator DECnet Node Address field and 16 
bits from the Initiator Logical Link Address field of the initiator 
address 138/158 in the packet header. 

FIG. 9 is a flow chart of the steps of the method of the present 
invention performed by the session information collecting part 92 to 
process a packet header from a Transport Layer level packet. If the 
packet header is from a Session Control packet, such as the 'connect 
initiate' packet of FIG. 8a, (Step 160), control passes to Step C of 
FIG. 10. If the packet header is from a data packet, such as the packet 
header of FIG. 8b, (Step 162), control passes to Step D of FIG. 11. If 
the packet header is from a Link service packet (Step 164), control 
passes to Step E of FIG. 12. If the packet header is from an ACK packet 
(Step 166), control passes to Step F of FIG. 13. If the packet header 
is from some other type of packet, then the unknown packet type is 
processed (Step 168)." (col. 8, line 61 - col. 9, 25) 
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Such excerpt, however, merely suggests a technique for managing packets based on a header 
thereof. This clearly falls short of the specific functional interaction between a first and second 
analyzer , as claimed by appellant. 

Specifically, there is no " sending one or more messages to the second analyzer " in response to 
the specific condition of an " unsuccessful session reconstruction ,'' as claimed, "wherein the one 
or more messages from the first analyzer to the second analyzer comprise packets received by 
the first analyzer which are unrecognized, and the second analyzer recognizes the unrecognized 
packets to successfiilly reconstruct the session " (or similar language). 

Appellant argues that the clear deficiencies in the Examiner's proposed combination would not 
have been obvious, since such aspects of the claimed invention provide such paramount benefits. 
By appellant's unique claimed features, the present invention is capable of better dealing with 
unrecognized packets by sending them to another analyzer for recognizing the unrecognized 
packets to successfully reconstruct the session. Appellant contends that simply nowhere in the 
prior art is there such a multi-analyzer technique, as specifically claimed, for improved session 
reconstruction. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. In re 
VaeckMl F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 
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Group #2: Claim 3 



With respect to Group #2, the Examiner rehes on page 5, lines 14-19; and page 6, lines 14-15 
and 23-27 from Abromavage to make a prior art showing of appellant's claimed "wherein the 
one or more messages from the first analyzer to the second analyzer further comprise hints 
generated by the first analyzer" (see Claim 3). 

Such excerpts and the remaining Abromavage reference, however, fail to disclose, teach or even 
suggest any communication of "hints" between the alleged first analyzer and second analyzer 
[112, 120 of Fig. 1]. 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Group #3: Claims 4 and 16 

With respect to Group #3, the Examiner relies on page 5, lines 14-19; and page 6, lines 14-15 
and 23-27 from Abromavage to make a prior art showing of appellant's claimed "wherein hints 
for a packet comprise a time the packet was received and an address information for the packet" 
(see Claim 4). 

Such excerpts and the remaining Abromavage reference, however, fail to disclose, teach or even 
suggest any hint including "a time the packet was received and an address information for the 
packef between the alleged first analyzer and second analyzer [1 12, 120 of Fig. 1]. 

Specifically, page 6, lines 23-27 from Abromavage, for example, indicates information generated 
by a component (126) of the alleged second analyzer [120 of Fig. 1], not information 
communicated between the alleged first analyzer and second analyzer [1 12, 120 of Fig. 1]. 



Appellant's Brief-page 14 of 20 



Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Group #4: Claim 7 

With respect to Group #4, the Examiner relies on page 6, lines 16-27; and col. 10, lines 3-7 from 
Abromavage to make a prior art showing of appellant's claimed 'Vherein the one or more 
messages from the first analyzer to the second analyzer comprise summary of packets received 
by the first analyzer and one or more hints generated by the first analyzer" (see Claim 7). 

Such excerpts and the remaining Abromavage reference, however, fail to disclose, teach or even 
suggest any communication between the alleged first analyzer and second analyzer [112, 120 of 
Fig. 1], where such communication includes a "summary of packets received by the first 
analyzer and one or more hints generated by the first analyzer." 

Specifically, the cited excerpts only describe information generated by the alleged second 
analyzer [120 of Fig. 1], and thus can not possibly be communicated between the alleged first 
analyzer and second analyzer [112, 120 of Fig. 1]. 

Appellant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest appellant's claim language, as set forth hereinabove. 

Issue #4 

The Examiner has rejected Claims 5 and 17 under 35 U.S.C. 103(a) as being unpatentable over 
Abromavage et al. (WO 00/6881 1), in view of McCreery et al. (5,787,253). Appellant 
respectfully disagrees with such combination, as such references are deemed from non- 
analogous arts. 
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In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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IX APPENDIX OF CLAIMS (37 C.F.R. § L192(c)(9)) 



The text of the claims involved in the appeal is: 

1 . (Previously Amended) A method of reconstructing a session using a first analyzer 
coupled to a second analyzer and a data collector, the method comprising: 

performing session reconstruction on packets received at a first analyzer; responsive to 
successful session reconstruction on the first analyzer, sending a first message to at least one of a 
second analyzer separate from the first analyzer and a data collector, the first message 
corresponding to session data; and 

responsive to unsuccessful session reconstruction on the first analyzer, sending one or 
more messages to the second analyzer; 

wherein the one or more messages from the first analyzer to the second analyzer 
comprise packets received by the first analyzer which are unrecognized, and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session. 

2. (Cancelled) 

3. (Previously Amended) The method of claim 1, wherein the one or more messages from 
the first analyzer to the second analyzer further comprise hints generated by the first analyzer. 

4. (Original) The method of claim 3, wherein hints for a packet comprise a time the packet 
was received and an address information for the packet. 

5. (Original) The method of claim 1, wherein the packets received at the first analyzer are 
output from a filter for controlling which packets in a plurality of packets flowing into the filter 
reach the first analyzer. 

6. (Previously Amended) The method of claim 1, further comprising: 

performing session reconstruction on the one or more messages received at the second 
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analyzer; 

responsive to successful session reconstruction on the second analyzer, sending a first 
message to at least one of a third analyzer and the data collector, the first message corresponding 
to session data; and 

responsive to unsuccessful session reconstruction on the second analyzer, sending one or 
more messages to the third analyzer, the third analyzer also receiving one or more messages from 
a fourth analyzer. 

7. (Original) The method of claim 1, wherein the one or more messages from the first 
analyzer to the second analyzer comprise summary of packets received by the first analyzer and 
one or more hints generated by the first analyzer. 

8. (Previously Amended) The method of claim 1, fiirther comprising performing session 
reconstruction using the second analyzer on the one or more messages received from the first 
analyzer and the one or more messages received from a third analyzer, 

9. (Original) The method of claim 8, ftirther comprising sending a second message from the 
second analyzer to the data collector, the second message corresponding to session data. 

10. (Previously Amended) A system for reconstructing a session, the system comprising: 

a plurality of packet sources, each of the plurality of packet sources generating a plurality 
of packets; 

a plurality of separate analyzers, each of the plurality of analyzers coupled to a packet 
source in the plurality of packet sources, each of the plurality of analyzers for session 
reconstruction on respective packets in the corresponding packet source, at least one analyzers 
sending a first message corresponding to session data for reconstructed sessions to a first 
analyzer and a second message for unreconstructed session data in the respective packets to the 
first analyzer, 

and wherein the first analyzer responsive to receiving messages from at least one other 
analyzers attempts session reconstruction using the messages; 

wherein the second message comprises packets received by one analyzer which are 
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unrecognized, and the first analyzer recognizes the unrecognized packets to successfully 
reconstruct the session. 

1 1 . (Cancelled) 

12. (Previously Amended) The system of claim 10 wherein the second message further 
comprises hints. 

13. (Original) The system of claim 10 wherein the second message comprises summary of 
respective packets and hints. 

14. (Previously Presented) A method of reconstructing a session using a first analyzer 
coupled to a second analyzer, the method comprising: 

performing session reconstruction on packets received at a first analyzer; and 
responsive to unsuccessfiil session reconstruction on the first analyzer, sending one or 
more messages to a second analyzer separate fi:"om the first analyzer; 

wherein the one or more messages from the first analyzer to the second analyzer 
comprise packets received by the first analyzer which are unrecognized, and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session. 

15. (Previously Presented) The method of claim 14, wherein the one or more messages from 
the first analyzer to the second analyzer further comprise hints generated by the first analyzer. 

16. (Previously Presented) The method of claim 15, wherein the hints comprise a time when 
at least one of the packets was received and address information for the packet. 

17. (Previously Presented) The method of claim 14, wherein the packets received at the first 
analyzer are output from a filter for controlling which packets in a plurality of packets flowing 
into the filter reach the first analyzer. 
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In the event a telephone conversation would expedite the prosecution of this application, 
the Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees 
due in connection with the filing of this paper, the Commissioner is authorized to charge such 
fees to Deposit Account No. 50-1351 (Order No. XACTP016). 




Silicon Valley IP Group, P.C. 
P.O. Box 721120 
San Jose, California 95172-1 120 
Telephone: (408)971-2573 
Facsimile: (408)971-4660 
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